Once I did as you did and enabled scripting on my es instance, I was able to accomplish your goal. There were two tricky bits that I had to work through. First, I needed to add a filter to your search in order to add criteria to your scripted field. Second, I needed to make my scripted field a little more complicated in order to account for the undefined onboardingTimestamp values shown in your sample.
I did the following steps:
Create a scripted field:
((doc['orderOnboardTimestamp'].value ? doc['orderOnboardTimestamp'].value : doc['orderArrivalTimestamp'].value + (1000 * 60 * 60 * 24 * 9999)) - doc['orderArrivalTimestamp'].value) / 1000 / 60 / 60 / 24
This calcuates the difference between the onboard and arrival dates. If there is no onboard date, then the arrival date with an offset of 9999 days is used instead.
In discover, add a filter
Find any value in the newly created calculatedShipTime field and add a filter for it.
Edit the filter
- Hover over the filter, and click on the edit icon (furthest on the right)
Give it a meaningful Filter Alias, and modify the script of the filter
- Change the Filter Alias to 'Older than two days'
- Change the value param to 2
- Modify the comparison operator at the end of the 'script' value from '==' to '>='
- Click 'Done'
Save the search